Privacy Notice

Introduction

This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you.

This privacy notice applies to personal information processed by or on behalf of the practice.

This Notice explains:

  • Who we are, how we use your information and our Data Protection Officer
  • What kinds of personal information about you do we process?
  • What are the legal grounds for our processing of your personal information (including when we share it with others)?
  • What should you do if your personal information changes?
  • For how long your personal information is retained by us?
  • What are your rights under data protection laws?

The General Data Protection Regulation (GDPR) became law on 24th May 2016. This is a single EU-wide regulation on the protection of confidential and sensitive information. It enters into force in the UK on the 25th May 2018, repealing the Data Protection Act (1998).

For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”), and the Data Protection Act 2018 (currently in Bill format before Parliament) the practice responsible for your personal data is Walkden Medical Centre.

This Notice describes how we collect, use and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights.

How we use your information and the law.

Walkden Medical Centre will be what’s known as the ‘Controller’ of the personal data you provide to us.

We collect basic personal data about you which does not include any special types of information or location-based information. This does however include name, address, contact details such as email and mobile number etc.

We will also collect sensitive confidential data known as “special category personal data”, in the form of health information, religious belief (if required in a healthcare setting) ethnicity, and sex during the services we provide to you and or linked to your healthcare through other health providers or third parties.

Why do we need your information?

The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Walk-in Centre, OOH, etc.). These records help to provide you with the best possible healthcare.

NHS health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records which we hold about you may include the following information:

  • Details about you, such as your address, carer, legal representative, emergency contact details
  • Any contact the surgery has had with you, such as appointments, surgery visits, emergency appointments, etc.
  • Notes and reports about your health
  • Details about your treatment and care
  • Results of investigations such as laboratory tests, x-rays etc.
  • Relevant information from other health professionals, relatives or those who care for you

To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided.

How do we lawfully use your data?

We need to know your personal, sensitive and confidential data in order to provide you with Healthcare services as a General Practice, under the General Data Protection Regulation we will be lawfully using your information in accordance with:

  • Article 6, e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”
  • Article 9, (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

This Privacy Notice applies to the personal data of our patients and the data you have given us about your carers/family members.

Risk Stratification

Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from a number of sources including NHS Trusts and from this GP Practice. A risk score is then arrived at through an analysis of your de-identified information is only provided back to your GP as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary, your GP may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way, however you should be aware that your decision may have a negative impact on the timely and proactive provision of your direct care.

National screening programs

The NHS provides national screening programs so that certain diseases can be detected at an early stage. These screening programs include bowel cancer, breast cancer, cervical cancer, aortic aneurysms and a diabetic eye screening service.

The law allows us to share your contact information with Public Health England so that you can be invited to the relevant screening program.

More information can be found at: www.gov.uk/topic/population-screening-programmes.

Medicines Management

The Practice may conduct Medicines Management reviews of medications prescribed to its patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments.

Safeguarding

The practice is dedicated to ensuring that the principles and duties of safeguarding adults and children are holistically, consistently and conscientiously applied. Access to personal data and health information will be shared in some circumstances where it is legally required for the safety of the individuals concerned. For the purposes of safeguarding children and vulnerable adults, personal and healthcare data is disclosed under the provisions of the Children’s Act 1989 and 2006 and Care Act 2014.

How do we maintain the confidentiality of your records?

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

All of our staff receive appropriate and regular training to ensure they are aware of their personal responsibilities and have legal and contractual obligations to uphold confidentiality, enforceable through disciplinary procedures. Our staff have access to personal information where it is appropriate to their role and is strictly on a need-to-know basis. Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.

We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the information sharing principle following Dame Fiona Caldicott’s information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles.

Our practice policy is to respect the privacy of our patients, their families and our staff and to maintain compliance with the General Data Protection Regulations (GDPR) and all UK specific Data Protection Requirements. Our policy is to ensure all personal data related to our patients will be protected.

All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. The practice will, if required, sign a separate confidentiality agreement if the client deems it necessary. If a sub-contractor acts as a data processor for Walkden Medical Centre an appropriate contract (art 24-28) will be established for the processing of your information.

In certain circumstances you may have the right to withdraw your consent to the processing of data. Please contact the Practice Manager in writing if you wish to withdraw your consent. In some circumstances we may need to store your data after your consent has been withdrawn to comply with a legislative requirement.

Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified. Sometimes your information may be requested to be used for research purposes – the surgery will always gain your consent before releasing the information for this purpose in an identifiable format. In some circumstances you can Opt-out of the surgery sharing any of your information for research purposes.

With your consent we would also like to use your information to:

We would however like to use your name, contact details and email address to inform you of services that may benefit you, with your consent only. There may be occasions were authorised research facilities would like you to take part on innovations, research, improving services or identifying trends.

At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent and opt out prior to any data processing taking place.

This information is not shared with third parties or used for any marketing and you can unsubscribe at any time via phone, email or by informing the Practice Manager.

Mobile Telephone

If you provide us with your mobile phone number we may use this to send you reminders about any appointments or other health screening information being carried out.

Who are our partner organisations?

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations;

  • NHS Trusts / Foundation Trusts
  • Out of Hours / Extended Hours services
  • GP’s
  • NHS Commissioning Support Units
  • Independent Contractors such as dentists, opticians, pharmacists
  • Private Sector Providers
  • Voluntary Sector Providers
  • Salford CCG / Salford Primary Care Together / Salford Council
  • Social Care Services
  • NHS England (NHSE) and NHS Digital (NHSD)
  • Education Services
  • Fire and Rescue Services / Ambulance Trusts / Police and Judicial Services

You will be informed who your data will be shared with and in some cases asked for consent for this happen when this is required.

We also work with third parties and suppliers (data processors) to be able to provide our service to you. These include (but are not limited to):

  • Egton – clinical system provider (using the AWS highly secure cloud hosted system)
  • NHS Greater Manchester Shared service – IT services
  • Docman – cloud-based software platform that manages incoming clinical correspondence
  • Informatica
  • Optum – Scriptswitch
  • AccuRx – text messaging service
  • I Plato – text messaging service
  • MyGP App – healthcare needs app (appointments/prescriptions)
  • Vision 360
  • Lexacom – Dictation Software
  • Universe call recording (using a cloud storage system)
  • Footfall – online consultation platform/website
  • GP Connect – allows NHS111 to book you an appointment directly with our clinical system.
  • REACT – in conjunction with National Services for Health Improvement Ltd.
  • Medi2data

When we use a third-party service provider to process data on our behalf then we will always have an appropriate agreement in place to ensure that they keep the data secure, that they do not use or share information other than in accordance with our instructions and that they are operating appropriately. Examples of functions that may be carried out by third parties includes:

  • Medical report processing and/or subject access report requests (our practice outsources medical reporting work to an NHS Digital accredited company called Medi2Data, who process medical reports and SARs on behalf of the practice via a secure, encrypted portal).

There may be occasions whereby these organisations have potential access to your personal data, for example, if they are solving IT problems. To protect your data, we have contracts and / or Information Sharing Agreements in place stipulating the data protection compliance they must have and to re-enforce their responsibilities as a data processor to ensure your data is securely protected at all times.

We will not disclose your information to any 3rd party without your consent unless:

  • there are exceptional circumstances (life or death situations)
  • where the law requires information to be passed on as stated above
  • required for fraud management – we may share information about fraudulent activity in our premises or systems. This may include sharing data about individuals with law enforcement bodies.
  • It is required to be disclosed to the police or other enforcement, regulatory or government body for prevention and / or detection of crime

Data Protection Impact Assessments

The practice will complete Data Protection Impact Assessments (DPIA) to help identify and minimise the data protection risks of a project and for processing that is likely to result in a high risk to individuals or any major project which requires the processing of personal data.

A DPIA must:

  • describe the nature, scope, context and purposes of the processing.
  • assess necessity, proportionality and compliance measures.
  • identify and assess risks to individuals; and identify any additional measures to mitigate those risks.

Best practice dictates that the initial screening questionnaire should be started when:

  • The project / process is being designed and the scope has been agreed;
  • Before a system has been procured;
  • Before contracts/MOUs/agreements have been signed.

The DPIA will assess the level of risk and consider both the likelihood and the severity of any impact on individuals. High risk could result from either a high probability of some harm, or a lower possibility of serious harm.

Not every new project, system or change in process will require a DPIA. The Information Commissioner’s Office (ICO) recommends that DPIAs are completed to comply with a change in law, introduction of new or intrusive technology or where person identifiable or sensitive information which was originally collected for a limited purpose is going to be collected for any new purpose(s) or reused in a new and unexpected way.

Where the DPIA identifies a high risk that we cannot mitigate, we must consult the ICO before starting the processing. The ICO will give written advice within eight weeks, or 14 weeks in complex cases. If appropriate, we may issue a formal warning not to process the data or ban the processing altogether.

National Data Opt-Out

NHS Digital Purposes For Processing Patient Data

Patient data from GP medical records kept by GP practices in England is used every day to improve health, care and services through planning and research, helping to find better treatments and improve patient care. The NHS is introducing an improved way to share this information – called the General Practice Data for Planning and Research data collection.

NHS Digital will collect, analyse, publish and share this patient data to improve health and care services for everyone. This includes:

  • informing and developing health and social care policy
  • planning and commissioning health and care services
  • taking steps to protect public health (including managing and monitoring the coronavirus pandemic)
  • in exceptional circumstances, providing you with individual care
  • enabling healthcare and scientific research

Any data that NHS Digital collects will only be used for health and care purposes. It is never shared with marketing or insurance companies.

What Patient Data NHS Digital Collect

This collection will start from 1st September 2021. Patient data will be collected from GP medical records about:

any living patient registered at a GP practice in England when the collection started – this includes children and adults any patient who died after the data collection started, and was previously registered at a GP practice in England when the data collection started.

We will not collect your name or where you live. Any other data that could directly identify you, for example NHS number, General Practice Local Patient Number, full postcode and date of birth, is replaced with unique codes which are produced by de-identification software before the data is shared with NHS Digital.

This process is called pseudonymisation and means that no one will be able to directly identify you in the data. The diagram below helps to explain what this means. Using the terms in the diagram, the data we collect would be described as de-personalised.

The Data NHS Digital Collect

We will only collect structured and coded data from patient medical records that is needed for specific health and social care purposes explained above.

Data that directly identifies you as an individual patient, including your NHS number, General Practice Local Patient Number, full postcode, date of birth and if relevant date of death, is replaced with unique codes produced by de-identification software before it is sent to NHS Digital. This means that no one will be able to directly identify you in the data.

NHS Digital will be able to use the software to convert the unique codes back to data that could directly identify you in certain circumstances, and where there is a valid legal reason. This would mean that the data became personally identifiable in the diagram above. It will still be held securely and protected, including when it is shared by NHS Digital.

NHS Digital Will Collect

  • data on your sex, ethnicity and sexual orientation
  • clinical codes and data about diagnoses, symptoms, observations, test results, medications, allergies, immunisations, referrals and recalls, and appointments, including information about your physical, mental and sexual health
  • data about staff who have treated you

NHS Digital Does Not Collect

  • your name and address (except for your postcode in unique coded form)
  • written notes (free text), such as the details of conversations with doctors and nurses
  • images, letters and documents
  • coded data that is not needed due to its age – for example medication, referral and appointment data that is over 10 years old
  • coded data that GPs are not permitted to share by law – for example certain codes about IVF treatment, and certain information about gender re-assignment

Opting Out Of NHS Digital Collecting Your Data

More Information can be found at nhs.uk/your-nhs-data-matters or by calling 0300 303 5678.

If you do not want your identifiable patient data to be shared outside of your GP practice for purposes except for your own care, you can ‘Opt out.’ You can register an ‘Opt out’ at any time and you can also change your mind at any time.

You can ‘Opt out’ using any of the following ways:

Where a proxy user wishes to opt out for a child under 12, or for someone for whom you have Power of Attorney, only the print and post option can be used.

You do not need to do anything if you are happy about how your confidential patient information is used.

NHS Digital

NHS Digital is a national body which has legal responsibilities to collect information about health and social care services. It collects information from across NHS providers in England and provides reports on how the NHS is performing. These reports helps plan and improve services to patients. This practice must comply with the law and send data to NHS Digital when it is told to do so by the Secretary of State for Health or NHS England under the Health and Social Care Act 2012.

More information about NHS Digital and how it uses information can be found at:  https://digital.nhs.uk/home.

How long will we store your information?

We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records management code of practice for health and social care and national archives requirements.

More information on records retention can be found online at www.nhsx.nhs.uk/information-governance/guidance/records-management-code.

How can you access, amend move the personal data that you have given to us?

Even if we already hold your personal data, you still have various rights in relation to it. To get in touch about these, please contact us. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

Right to rectification

If considered appropriate, a retrospective entry can be made by a clinician if you have concerns regarding the accuracy of your clinical record.

Right to object

If we are using your data because we deem it necessary for our legitimate interests to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply i.e. safeguarding reasons.

Right to withdraw consent

Where we have obtained your consent to process your personal data for certain activities (for example for a research project), or consent to market to you, you may withdraw your consent at any time.

Right to erasure

In certain situations (for example, where we have processed your data unlawfully), you have the right to request us to “erase” your personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply. If we do agree to your request, we will delete your data but will generally assume that you would prefer us to keep a note of your name on our register of individuals who would prefer not to be contacted. That way, we will minimise the chances of you being contacted in the future where your data are collected in unconnected circumstances. If you would prefer us not to do this, you are free to say so.

Right of data portability

If you wish, you have the right to transfer your data from us to another data controller. We will help with this with a GP to GP data transfer and transfer of your hard copy notes.

Access to your personal information

Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. To request this, you need to do the following:

  • Your request should be made to the Practice – for information from the hospital you should write direct to them
  • There is no charge to have a copy of the information held about you
  • We are required to respond to you within one month
  • You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified, and your records located information we hold about you at any time.

What should you do if your personal information changes?

You should tell us so that we can update our records please contact the receptionist as soon as any of your details change, this is especially important for changes or address or contact details (such as your mobile phone number), the practice will from time to time ask you to confirm that the information we currently hold is accurate and up-to-date.

Notifications

The Data Protection Act 1998 requires organisations to register a notification with the Information Commissioner to describe the purpose for which they process personal and sensitive information.

This information is publicly available of the Information Commissioner’s Office website (ICO) at www.ico.org.uk

The practice is registered with the ICO.

Objections / Complaints

Should you have any concerns about how your information is managed at the GP practice, please contact the Practice Manager.

If you are still unhappy following a review by the GP practice, you have a right to lodge a complaint with a supervisory authority: You have a right to complain to the UK supervisory Authority as below.

Information Commissioner:
Wycliffe house
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 01625 545745

Website: www.informationcommissioner.gov.uk

If you are happy for your data to be extracted and used for the purposes described in this privacy notice, then you do not need to do anything. If you have any concerns about how your data is shared, then please contact the Practice Manager

If you would like to know more about your rights in respect of the personal data we hold about you, please contact the Data Protection Officer as below.

Data Protection Officer:

The Practice Data Protection Officer is Salford GP DPO at Salford CCG. Any queries in regard to Data Protection issues should be addressed to her at:

Email: [email protected]

Postal: Salford DPO
St James’s House
Pendleton Way
Salford
M6 5FW

Changes:

It is important to point out that we may amend this Privacy Notice from time to time.  If you are dissatisfied with any aspect of our Privacy Notice, please contact the Practice Data Protection Officer.