Privacy Policy

Privacy Policy

Privacy Notice

Dr Hilton & Partners (CARTERKNOWLE & DORE MEDICAL PRACTICE)

Data Protection Privacy Notice

INTRODUCTION

This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you.

This privacy notice applies to personal information processed by or on behalf of the practice.

This Notice explains

Who we are, how we use your information and our Data Protection Officer

What kinds of personal information about you do we process?

What are the legal grounds for our processing of your personal information (including when we share it with others)?

What should you do if your personal information changes?

For how long your personal information is retained by us?

What are your rights under data protection laws?

In accordance with the applicable data protection legislation in the UK (The Data Protection Act 2018 and the UK General Data Protection Regulation (UKGDPR) the practice responsible for your personal data is Dr Hilton & Partners (Carterknowle & Dore Medical Practice).

This Notice describes how we collect, use, and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights

HOW WE USE YOUR INFORMATION AND THE LAW

Dr Hilton & Partners (Carterknowle and Dore medical practice) is known as the ‘Controller’ of the personal data you provide to us.

We will collect basic personal data about you which includes name, address, date of birth and contact details such as email and mobile number etc.

We will also collect sensitive confidential data known as “special category personal data”, in the form of health information, religious belief (if required in a healthcare setting) ethnicity, and sexual orientation through the delivery of services we provide to you and/or linked to your healthcare through other health providers or third parties.

WHY DO WE NEED YOUR INFORMATION?

The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare.

NHS health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records which the Practice hold about you may include the following information:

Details about you, such as your address, carer, legal representative, emergency contact details

Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.

Notes and reports about your health

Details about your treatment and care

Results of investigations such as laboratory tests, x-rays etc

Relevant information from other health professionals, relatives or those who care for you

Your records are used to ensure you receive the best possible care. . Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided.

HOW DO WE LAWFULLY USE YOUR DATA?

We need to know your personal, sensitive and confidential data in order to provide you with Healthcare services as a General Practice, under the UK General Data Protection Regulation we will be lawfully using your information in accordance with:

Article 6, e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”

Article 9, (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

This Privacy Notice applies to the personal data of our patients and the data you have given us about your carers/family members.

Risk Stratification

Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from several sources including NHS Trusts and from this GP Practice.

A risk score is then arrived at through an analysis of your de-identified information and is only provided back to your GP as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary, your GP may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way – please see the section on Your Rights below.

Medicines Management

The Practice may conduct Medicines Management reviews of medications prescribed to its patients under a processing arrangement with the Medicines Management Team at Sheffield Clinical Commissioning Group. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments.

ECLIPSE LIVE

What information will be shared?

A code that is linked to you on our local system.

• NHS Number
• Gender
• Age
• Postcode
• Codes that tell us the medication you are on Issue date of medication
• Whether the medication is repeated
• Any directions on how you take your medication.
• Any coded diagnosis that you have
• Recent results, like blood glucose or blood pressure

How is my information protected?

After being extracted from your health records, your personal information is “hidden” through a process called pseudonymization. Only pseudonymized information is shared ECLIPSELIVE. More information can be found at: https://www.eclipselive.org/primary-care

The practice performs computerised searches of some or all our records to identify individuals who may be at increased risk of certain conditions or diagnoses i.e. Diabetes, heart disease, risk of falling. Your records may be amongst those searched. This is often called “risk stratification” or “case finding”. These searches are sometimes carried out by professionals who link our records to other records that they access, such as hospital attendance records. The results of these searches and assessments may then be shared with other NHS workers, such as pharmacists, or purchasers of healthcare (commissioners). The information that is shared is to enable the other NHS workers to provide the most appropriate advice, investigations, treatments, therapies, and care.

The legal basis for this processing is Article 6(1)(e); “necessary… in the exercise of official authority vested in the controller’

And

Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”

You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.

GP medical records will be kept in line with the law and national guidance. Data will be held by ECLIPSELIVE for up to 1 week. Information on how long records can be kept can be found at: https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016

HOW YOUR INFORMATION IS SHARED SO THAT THIS PRACTICE CAN MEET LEGAL REQUIREMENTS

The law requires the practice to share information from your medical records in certain circumstances. Under the UKGDPR we will be lawfully using your information in accordance with

Article 6(1)(c) – ‘processing is necessary for compliance with a legal obligation to which the controller is subject…’

Article 9(2)(h) – ‘processing is necessary for the purpose of preventative…medicine…the provision of health or social care or treatment or the management of health or social care systems and services…’

Information is shared so that the NHS or Public Health England can, for example:

plan and manage services

check that the care being provided is safe

prevent infectious diseases from spreading

We will share information with NHS Digital, the Care Quality Commission and local health protection team (or Public Health England) when the law requires us to do so. Please see below for more information.

We must also share your information if a court of law orders us to do so.

NHS Digital

NHS Digital is a national body which has legal responsibilities to collect information about health and social care services.

It collects information from across the NHS in England and provides reports on how the NHS is performing. These reports help to plan and improve services to patients.

This practice must comply with the law and will send data to NHS Digital, for example, when it is told to do so by the Secretary of State for Health or NHS England under the Health and Social Care Act 2012.

More information about NHS Digital and how it uses information can be found at:

https://digital.nhs.uk/home

https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-practice-data-for-planning-and-research/transparency-notice

This practice is supporting vital health and care planning and research by sharing your data with NHS Digital. For more information about this see the GP Practice Privacy Notice for General Practice Data for Planning and Research.

Care Quality Commission (CQC)

The CQC regulates health and social care services to ensure that safe care is provided.

The law says that we must report certain serious events to the CQC, for example, when patient safety has been put at risk.

For more information about the CQC see: http://www.cqc.org.uk/

Public Health

The law requires us to share data for public health reasons, for example to prevent the spread of infectious diseases or other diseases which threaten the health of the population.

We will report the relevant information to local health protection team or Public Health England.

For more information about Public Health England and disease reporting see: https://www.gov.uk/guidance/notifiable-diseases-and-causative-organisms-how-to-report

National screening programmes

The NHS provides national screening programmes so that certain diseases can be detected at an early stage.

These screening programmes include bowel cancer, breast cancer, cervical cancer, aortic aneurysms and a diabetic eye screening service.

The law allows us to share your contact information with Public Health England so that you can be invited to the relevant screening programme. The following sections of the UK GDPR allow us to contact patients for screening.

Article 6(1)(e) – ‘processing is necessary…in the exercise of official authority vested in the controller…’’

Article 9(2)(h) – ‘processing is necessary for the purpose of preventative…medicine…the provision of health or social care or treatment or the management of health or social care systems and services…’

For national screening programmes you can opt so that you no longer receive an invitation to a screening programme.

See: https://www.gov.uk/government/publications/opting-out-of-the-nhs-population-screening-programmes

More information can be found at: https://www.gov.uk/topic/population-screening-programmes or speak to the practice.

PORTER VALLEY PRIMARY CARE NETWORK

In June 2019 the Government through the new GP contract has determined that practices will work together across populations of 30-50 thousand in order to create more collaborative workforces which will ease the pressure of GP’s, leaving them better able to focus on patient care. Primary care networks form a key building block of the NHS long-term plan. Bringing general practices together to work at scale has been a policy priority for some years for a range of reasons, including improving the ability of practices to recruit and retain staff; to manage financial and estates pressures; to provide a wider range of services to patients and to more easily integrate with the wider health and care system. The aim is that by July 2019, all areas within England will be covered by a PCN.

Dr Hilton & Partners (Carterknowle and Dore surgery) is in the Porter Valley Network along with Nethergreen Surgery, Rustlings Road Surgery, The Hollies Medical Practice, Falkland road surgery and Greystones Surgery.

This means the practice may share your information with the other practices within the Porter Valley PCN to provide you with your care and treatment. The Practices within the PCN have a robust Data Sharing Agreement between them as well as a shared standards, policies and procedures for information governance.

OUR COMMITMENT TO DATA PRIVACY AND CONFIDENTIALITY

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

Data Protection Act 2018

The UK General Data Protection Regulation

Human Rights Act 1998

Common Law Duty of Confidentiality

Health and Social Care Act 2012

NHS Codes of Confidentiality, Information Security and Records Management

In the circumstances where we are required to use personal identifiable information, we will only do this if:

The information is necessary for your direct healthcare, or

We have received explicit consent from you to use your information for a specific purpose, or

There is an overriding public interest in using the information:

In order to safeguard an individual,

To prevent a serious crime or in the case of Public Health or other emergencies, to protect the health and safety of others, or

There is a legal requirement that allows or compels us to use or provide information (e.g. a formal court order or legislation), or

We have permission from the Secretary of State for Health and Social Care to use certain confidential patient identifiable information when it is necessary for our work

Everyone working for the NHS has a legal and contractual duty to keep information about you confidential.

Our practice policy is to respect the privacy of our patients, their families and our staff and to maintain compliance with the UK General Data Protection Regulation (UKGDPR) and all UK specific Data Protection requirements. Our policy is to ensure all personal data related to our patients will be protected.

All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. The practice will, if required, sign a separate confidentiality agreement if the client deems it necessary. If a sub-contractor acts as a data processor an appropriate contract (art 24-28) will be established for the processing of your information.

Where information is held centrally and used for statistical purposes, we take strict measures to ensure that individual patients cannot be identified. Sometimes your information may be requested to be used for research purposes – the surgery will always gain your consent before releasing the information for this purpose in an identifiable format. In some circumstances you can Opt-out of the surgery sharing any of your information for research purposes – please see Your Rights section below.

WHERE YOUR CONSENT IS REQUIRED

We would like to use your name, contact details and email address to inform you of services that may benefit you, with your consent only. There may be occasions where authorised research facilities would like you to take part in innovations, research, improving services or identifying trends.

At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent and opt out prior to any data processing taking place.

This information is not shared with third parties or used for any marketing and you can withdraw your consent at any time via phone, email or by informing the practice as below.

WHERE DO WE STORE YOUR INFORMATION?

All the personal data we hold is processed and stored in the UK. Your information will not be sent outside of the UK where the laws do not protect your privacy to the same extent as the law in the UK. We will never sell any information about you.

No third parties have access to your personal data unless the law allows them to do so and appropriate safeguards have been put in place.

WHO ARE OUR PARTNER ORGANISATIONS?

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations:

NHS Trusts / Foundation Trusts

GPs

NHS Commissioning Support Units

Independent Contractors such as dentists, opticians, pharmacists

Private Sector Providers

Voluntary Sector Providers

Ambulance Trusts

Clinical Commissioning Groups

Social Care Services

NHS England (NHSE) and NHS Digital (NHSD)

Local Authorities

Education Services

Fire and Rescue Services

Police & Judicial Services

Voluntary Sector Providers

Private Sector Providers

Other ‘data processors’ which you will be informed of

We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure. All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. If a sub-contractor acts as a data processor an appropriate contract (UKGDPR Article 24-28) will be established for the processing of your information.

HOW LONG WILL WE STORE YOUR INFORMATION?

We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records management code of practice for health and social care and national archives requirements.

More information on records retention can be found online at (https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016 )

YOUR RIGHTS

Under the UK General Data Protection Regulation all individuals have certain rights in relation to the information which the Practice holds about them. Not all rights apply equally to all our processing activity as certain rights are not available depending on the lawful basis for the processing. To get in touch about these, please contact us. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

Examples of where rights may not apply – where our lawful basis is:

Processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller – then rights of erasure, portability do not apply.

Legal Obligation – then rights of erasure, portability, objection, automated decision making and profiling do not apply.

If you require further detail each link below will take you to the Information Commissioner’s Office’s website where further detail is provided in section ‘When does the right apply’.

These rights are:

The right to be informed about the processing of your data

The right of access to the data held about you

The right to have that information amended in the event that it is not accurate

The right to have the information deleted

The right to restrict processing

The right to have your data transferred to another organisation (data portability)

The right to object to processing

Rights in relation to automated decision making and profiling

Under the NHS Constitution you have the right to privacy and to expect the NHS to keep your information confidential and secure.

You have the right to be informed about how your information is used.

Supporting these rights patients in England also have the right under the NHS Constitution to request that their personal confidential data is not used for reasons other than their individual care and treatment. The process for applying this right is called the ‘National Patient Data Opt-out’ this gives patients and the public the opportunity to make an informed choice about whether they wish their personally identifiable data to be used just for their individual care and treatment or also used for research and planning purposes.

However, there are exemptions to this, the national patient data opt-out applies unless:

There is a mandatory legal requirement or an overriding public interest for the data to be shared e.g. Adults and Children safeguarding.

The opt-out does not apply when the individual has consented to the sharing of their data; or

Where the data is anonymised in line with the Information Commissioner’s Office (ICO) Code of Practice on Anonymisation.

To be compliant with the national data opt-out policy the Practice has put procedures in place to review uses or disclosures of confidential patient information against the national data opt-out operational policy guidance.

If you believe the Practice is using your personal information in a way you would object to or contrary to your National Patient Data Opt-Out request, you have the right to object and have your objections considered and where your wishes cannot be followed, to be told the reasons including the legal basis.

For further details of the national patient data opt out can be found here: https://www.nhs.uk/your-nhs-data-matters/

ACCESS TO YOUR PERSONAL INFORMATION

Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. To request this, you need to do the following:

Your request should be made to the Practice – for information from the hospital you should write direct to them

There is no charge to have a copy of the information held about you

We are required to respond to you within one month

You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified, and your records located information we hold about you at any time.

WHAT SHOULD YOU DO IF YOUR PERSONAL INFORMATION CHANGES?

You should tell us so that we can update our records please contact Reception as soon as any of your details change, this is especially important for changes of address or contact details (such as your mobile phone number), the practice will from time to time ask you to confirm that the information we currently hold is accurate and up-to-date.

QUERIES/COMPLAINTS

Should you have any concerns about how your information is managed at the GP, please contact the GP Practice Manager. If you are still unhappy following a review by the GP practice, you have a right to lodge a complaint with a supervisory authority: You have a right to complain to the UK supervisory Authority as below.

Information Commissioner:

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Tel: 0303 1231113 or 01625 545745

https://ico.org.uk/

If you would like to know more about your rights in respect of the personal data we hold about you, please contact the GP Practice Manager.

DATA PROTECTION OFFICER

This Practice have appointed Caroline Million to be the designated Data Protection Officer.  She can be contacted on caroline.million@nhs.net

CHANGES

It is important to point out that we may amend this Privacy Notice from time to time. If you are dissatisfied with any aspect of our Privacy Notice, please contact the GP Practice Manager.

COVID 19

A number of additional Privacy Notices have been added in relation to national activity related to the Covid 19 pandemic:

https://www.gov.uk/government/publications/privacy-notice-for-covid-19-response-activity/privacy-notice-for-covid-19-response-activity

SCR coronavirus (COVID-19) supplementary privacy notice – NHS Digital